Privacy Policy

1 Introduction

1.1 pwin is committed to protecting the privacy and personal data of its players. As a PAGCOR-regulated online gaming platform serving Filipino adults, pwin processes personal data in the ordinary course of providing gaming, payment, and customer support services.

1.2 This Policy is intended to be read alongside pwin's Terms and Conditions and Responsible Gaming Policy. Together, these documents govern your relationship with the pwin platform.

1.3 If you have any questions about this Policy or how pwin handles your personal data, you may contact our Data Protection Officer at the details set out in Section 15 below. We will respond to all privacy-related enquiries within fifteen (15) business days.

1.4 pwin has registered as a Personal Information Controller with the National Privacy Commission (NPC) of the Republic of the Philippines as required under the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations.

2 Who We Are

2.1 For the purposes of this Policy, the Personal Information Controller responsible for your personal data is:

2.2 As Personal Information Controller, pwin determines the purposes and means of processing your personal data. Certain processing activities may be carried out by third-party Personal Information Processors acting under pwin's instructions, as described in Section 7 of this Policy.

3 Personal Data We Collect

3.1 pwin collects personal data across several categories depending on how you interact with the platform. The following table sets out the categories of personal data collected and examples within each category:

3.2 pwin does not intentionally collect special categories of personal data (i.e., data concerning racial or ethnic origin, health, religious beliefs, political opinions, or sexual orientation) unless such data is voluntarily provided by a Player in the context of a responsible gaming or support interaction, in which case it will be processed only as necessary for that purpose.

4 How We Collect Your Data

4.1 pwin collects personal data through the following means:

Direct Collection

Data you provide directly to pwin when you register an account, complete KYC verification, make a deposit or withdrawal, use a bonus or promotion, contact customer support, complete a responsible gaming self-assessment, or respond to surveys or feedback requests.

Automated Collection

Technical and behavioral data collected automatically through your use of the pwin platform, including data gathered via cookies, web server logs, and analytics tools as described in Section 10 of this Policy.

Third-Party Sources

4.2 pwin may receive personal data from third parties in limited circumstances, including:

• Payment processors (GCash, Maya, BPI, BDO, Metrobank) confirming transaction details;
• Identity verification service providers confirming the authenticity of submitted KYC documents;
• Fraud prevention and anti-money laundering screening services;
• Responsible gaming registries, where a Player has registered a self-exclusion with a third-party service that is interoperable with PAGCOR-regulated operators.

5 How We Use Your Personal Data

5.1 pwin uses your personal data for the following purposes:

5.2 pwin will not use your personal data for purposes incompatible with those listed above without your prior written consent or as required by applicable Philippine law.

6 Legal Basis for Processing

6.1 Under the Data Privacy Act of 2012, pwin processes your personal data on the following lawful bases:

• Contractual Necessity: Processing required to fulfil pwin's obligations under its Terms and Conditions, including account management, game delivery, and payment processing;
• Legal Obligation: Processing required to comply with PAGCOR licensing conditions, Anti-Money Laundering Act (AMLA) obligations, Republic Act No. 9160 as amended, and other applicable Philippine law;
• Legitimate Interest: Processing undertaken for fraud prevention, platform security, responsible gaming monitoring, and aggregate analytics, where such interests do not override your fundamental rights and freedoms;
• Consent: Processing for optional purposes such as promotional communications and non-essential personalisation, where you have provided freely given, specific, informed, and unambiguous consent that may be withdrawn at any time.

7 Sharing Your Personal Data

7.1 pwin does not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes. pwin shares your personal data only in the following circumstances:

Service Providers (Personal Information Processors)

7.2 pwin engages third-party service providers who process personal data strictly on pwin's behalf under written data processing agreements. These include:

• Payment processors (GCash/Maya/bank payment gateways) for transaction processing;
• Identity verification providers for KYC document checking;
• Cloud infrastructure providers hosting the pwin platform and databases;
• Customer support software providers;
• Fraud detection and cybersecurity service providers;
• Game software providers supplying certified gaming engines to the Platform.

Regulatory and Law Enforcement Authorities

7.3 pwin will disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities where required to do so by law, court order, or binding regulatory directive.

Business Transfers

7.4 In the event of a merger, acquisition, reorganisation, or sale of assets involving pwin, your personal data may be transferred to the successor entity, subject to the same privacy protections as set out in this Policy. You will be notified of any such transfer via your registered email address.

8 International Data Transfers

8.1 pwin's primary data processing activities are conducted within the Philippines. Where any personal data is transferred to or processed by service providers outside the Philippines, pwin ensures that such transfers are made:

• To countries deemed by the NPC to provide an adequate level of protection for personal data; or
• Subject to appropriate contractual safeguards, including standard contractual clauses approved under Philippine data privacy law; or
• With your explicit consent where required by law.

8.2 pwin maintains records of all international data transfers and makes these available to the NPC upon request.

9 Data Retention

9.1 pwin retains personal data for the minimum period necessary to fulfil the purpose for which it was collected, subject to the following minimum retention requirements:

9.2 Upon expiry of the applicable retention period, pwin will securely delete or anonymise your personal data in accordance with its data disposal procedures, unless a longer retention period is required by law or regulatory directive.

10 Cookies & Tracking Technologies

10.1 The pwin platform uses cookies and similar tracking technologies to deliver a functional, secure, and personalised user experience. The following categories of cookies are used on pwin.bid:

• Strictly Necessary Cookies: Essential for the basic functioning of the Platform — including maintaining your login session, storing your account preferences, and enabling secure payment flows. These cookies cannot be disabled.
• Performance and Analytics Cookies: Used to collect aggregated and anonymised data about how players navigate and use the Platform, enabling pwin to identify and resolve technical issues and improve the user experience.
• Functionality Cookies: Remember your personal preferences — such as language settings, game lobby view preferences, and notification settings — to provide a more consistent experience across sessions.
• Security Cookies: Support fraud prevention and account security functions, including session integrity verification and abnormal activity detection.

10.2 pwin does not use third-party advertising or cross-site tracking cookies. Analytics data collected on pwin.bid is not shared with advertising networks or social media platforms.

10.3 Most browsers allow you to control cookies through their settings. Disabling strictly necessary cookies may impair the functionality of the pwin Platform and your ability to access your account or complete transactions.

11 Data Security

11.1 pwin implements technical and organisational security measures designed to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• 256-bit Transport Layer Security (TLS/SSL) encryption for all data transmitted between your device and pwin's servers;
• Encryption at rest for sensitive personal and financial data stored in pwin's databases;
• Role-based access controls ensuring that pwin employees access only personal data necessary for their specific job functions;
• Two-factor authentication requirements for administrative access to pwin's internal systems;
• Regular vulnerability assessments and penetration testing of platform infrastructure;
• Formal incident response procedures in line with NPC breach notification requirements under the DPA;
• Staff training on data privacy obligations and secure data handling practices.

11.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, pwin will notify the NPC within seventy-two (72) hours of becoming aware of the breach, and will notify affected Players without undue delay where required under the DPA.

12 Your Rights as a Data Subject

12.1 Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by pwin. All rights requests should be submitted in writing to pwin's Data Protection Officer at the contact details in Section 15. pwin will respond within fifteen (15) business days of receiving a valid request.

13 Children and Minors

13.1 Age verification is a mandatory step in the pwin registration and KYC processes. Any attempt to circumvent age verification controls constitutes a material breach of pwin's Terms and Conditions.

13.2 Parents and guardians who believe that a minor may have registered an account on pwin are encouraged to contact pwin's Customer Support immediately. All such reports will be acted upon within one (1) business day.

14 Changes to This Privacy Policy

14.1 pwin reserves the right to update or revise this Privacy Policy at any time to reflect changes in applicable law, PAGCOR regulatory requirements, pwin's data processing practices, or for any other legitimate operational reason.

14.2 Material changes to this Policy will be communicated to registered Players via the email address on their Account not less than fourteen (14) days before the revised Policy takes effect, except where a shorter notice period is required by law.

14.3 The current version of this Privacy Policy is always available at pwin.bid/privacy-policy. The effective date at the top of this document reflects the most recent revision. Continued use of the Platform after the effective date of any revision constitutes acceptance of the updated Policy.

14.4 If changes to this Policy require your fresh consent for any new processing activities, pwin will seek that consent separately before commencing the relevant processing.

15 Contact & Data Protection Officer

15.1 For all data privacy enquiries, rights requests, or to report a concern about pwin's handling of your personal data, please contact pwin's Data Protection Officer:

15.2 If you are not satisfied with pwin's response to a privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines:

15.3 Players in Cebu, Davao, and other regions outside Metro Manila may also submit NPC complaints via the NPC's online portal. pwin will cooperate fully with any NPC investigation or enquiry relating to its data processing practices.